L. C. Hsieh created SPARK-60590:
-----------------------------------
Summary: Update webpki-roots, rustls-webpki and tokio in
Cargo.lock to pick up recent RustSec advisories
Key: SPARK-60590
URL: https://issues.apache.org/jira/browse/SPARK-60590
Project: Spark
Issue Type: Sub-task
Components: Connect
Affects Versions: connect-gateway-0.1.0
Reporter: L. C. Hsieh
Assignee: L. C. Hsieh
The scheduled `cargo audit` run on main has failed daily since it was enabled
(SPARK-60370). Two of its findings, plus one warning, have fixed releases:
RUSTSEC-2026-0381 webpki-roots 1.0.9 -> 1.0.10
Bundled root certificates allow trust in distrusted
emSign intermediates.
RUSTSEC-2026-0382 rustls-webpki 0.103.14 -> 0.103.16
Certificate verification may accept distrusted
intermediates.
RUSTSEC-2026-0386 tokio 1.53.1 -> 1.53.3 (reported as a warning: unsound)
`AsyncFd::new` and related constructors violate I/O
safety.
The two webpki advisories affect the gateway: both crates are compiled into
it and sit on the outbound TLS certificate-verification path (kube-client for
the K8s API, reqwest for OIDC JWKS, tonic / opentelemetry-otlp).
This is a lockfile-only change; no Cargo.toml edit is needed.
The scheduled run's remaining failure, RUSTSEC-2026-0387 (crypto-bigint
0.5.5), has no fix reachable from the current dependency graph and is not
addressed here.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
